Previous efforts on preventing DNN architecture stealing have focused on hardware to eliminate information leakage. Oblivious Random Access Memory (ORAM) technology [1]}, [2]} prevents memory access leakage by encrypting the memory address.
[3]} proposes re-design of the Miss Status Holding Registers (MSHR) to obfuscate GPU memory access to add a layer of randomness.
Though hardware modifications are effective countermeasures, they are not beneficial to existing devices and have high performance overhead.
Recently, [4]} proposed a decision tree-based detection method against spy applications on GPU. However, it suffers from high false positive rate and is not practical.
TVM [5]} has also been proposed as a potential countermeasure. Nevertheless, as shown by our experiments (fig:tunertest), standard TVM does not show enough randomness to be an effective countermeasure.
